LiteLLM Pass-Through Endpoint IMDSv2 Bypass via x-pass- Header Stripping

Arnold Chan@slaz

•updated Sep 12, 2026•0•0•4

Detects attempts to bypass AWS IMDSv2 security protections via the LiteLLM /config/pass_through_endpoint, where attackers inject the 'x-pass-X-aws-ec2-metadata-token' header to potentially strip authentication requirements.